Public PoC Released for Apache Superset SQL Injection Vulnerability

A public proof-of-concept exploit has been released for CVE-2026-23980, a SQL injection vulnerability affecting Apache Superset versions before 6.0.0.

The flaw could allow authenticated users with read-level access to trigger error-based SQL injection through specific application parameters.

Apache Superset is an open-source data exploration and visualization platform widely used to build dashboards, query databases, and share business intelligence reports.

Because the platform can connect to sensitive enterprise data sources, SQL injection flaws in its query-handling functions can create serious security concerns for organizations that expose Superset instances to multiple users.

The vulnerability, tracked as CVE-2026-23980, is classified as an Improper Neutralization of Special Elements used in a SQL Command issue, commonly known as SQL injection.

PoC Released: Apache Superset SQL Injection Flaw

According to the Apache Superset advisory, the vulnerable application handling involves the sqlExpression and where parameters. An authenticated attacker with read access could supply specially crafted input to these parameters and cause the application to return database errors.

Error-based SQL injection can help an attacker understand the underlying query structure, database behavior, table names, column names, and other useful information.

Depending on the target deployment, this information could support further attempts to access or infer sensitive records. The issue affects all Apache Superset releases from version 0.0.0 up to, but not including, version 6.0.0.

Apache has addressed the vulnerability in Superset 6.0.0 and recommends that all users upgrade to the fixed release as soon as possible.

Security researchers have also published a public repository containing a modified exploit for CVE-2026-23980. The repository includes a Python file named exploit.py, indicating that technical details and proof-of-concept code are now public.

The availability of a PoC increases urgency for defenders because it lowers the effort attackers need to test whether exposed Superset environments are vulnerable.

The reported vulnerability was credited to Pritam Chakkerwar as the finder, Dhanush Nayak as the reporter, and Pedro Sousa as the remediation developer. Apache disclosed the issue in a security notice posted on February 24, 2026.

Organizations running Apache Superset should identify all instances, confirm their installed versions, and prioritize upgrades to version 6.0.0. Administrators should also review user accounts with dashboard and dataset read permissions, especially in environments where Superset connects to production databases or contains access to confidential business information.

Teams should inspect application and proxy logs for unusual requests involving the sqlExpression or parameters. Repeated malformed query requests, database error responses, unexpected SQL syntax fragments, or abnormal activity from authenticated low-privilege accounts may indicate attempted exploitation.

While the flaw requires authentication, read-only access should not be treated as harmless. In data analytics platforms, even limited user privileges can become valuable when an attacker can influence backend database queries.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.